Privacy Policy

1. Introduction

Last updated: 13 October 2026

Sort My Legacy ("we," "us," "our") is the name of the service; it is a product of Nexivaraand is operated by Nexivara at sortmylegacy.com. This Privacy Policy is our notice under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP"), and our privacy policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It describes what personal data we collect, why, who we share it with, how we protect it, and how you can use your rights. A summary in Hindi is at the top of this page.

Digital-only service: Sort My Legacy is a fully digital platform. We do not ship any physical products. All data and services are delivered online. No physical delivery or shipping is involved.

2. Who is responsible for your data

Nexivara (a sole proprietorship of Karan Bindal, which operates Sort My Legacy) is the Data Fiduciary for personal data processed through the Service. Bindal Infotech, Nexivara's IT vertical, builds and runs the technology and handles personal data only on our instructions. Our Grievance Officer answers questions about how we process your personal data, handles requests to use your rights, and handles complaints; their contact details are in Who we are, customer care and grievances at the end of this page. You may also use our contact form.

3. Personal Data We Collect

Account and profile:

• Email address, name, mobile number
• Date of birth, gender (optional)
• Address and identification details (e.g., PAN, Aadhaar) if you choose to provide them

What you record in the Service:

• Quiz answers, inventory entries, will drafts, document metadata and the documents you upload
• Family member details you add
• Legacy messages (letters and video links you create for your recipients)

Usage data:

• Log data (IP address, browser type, pages visited)

Health information (only if you use these optional features):

• Medical directives: life-support preferences, organ-donation wishes, do-not-resuscitate (DNR) preferences, and medical power-of-attorney details
• Emergency card: blood type, allergies, and emergency medical notes

You provide this health information voluntarily. We store it solely to make it available to you and to the family members, executors, or first responders you choose to share it with. We do not use health information for advertising, we never sell it, and we do not share it with third parties except the service providers needed to operate the Service (see Section 6) or where required by law.

Payment data:

• Website payments are processed by Razorpay; in-app purchases by Apple (App Store). We never see or store full card numbers
• Billing address, transaction identifiers

Password vault: Passwords are encrypted client-side. We never receive or store your master password or decrypted passwords. Zero-knowledge architecture.

Sensitive personal data: Under the IT Rules 2011, the sensitive personal data we may hold is the financial information you record in your inventory (for example bank, investment and insurance account details), the health information described above, and your password-vault entries (which we hold only in encrypted form and cannot read). We collect it only because you enter it, to provide the Service to you.

4. Purpose and Use

We use your data to:

• Provide and improve the Service
• Authenticate your account and enforce security
• Process payments, manage subscriptions, and issue invoices
• Send messages about your account (e.g., security alerts, payments, reminders, death-verification and emergency-access messages) by email, and by WhatsApp if you choose it
• Show your information to the family members and executors you give access to, on the terms you set
• Send one email (or, for an account created with a phone number, one WhatsApp message), once, to a free-plan account a few days after sign-up, explaining what the paid plans include, only while "Product news and offers" is on for that account (see Section 5)
• Send one WhatsApp reminder, once, to a person who completed the readiness quiz, ticked "Send me one reminder about my result on WhatsApp" and left a phone number, but did not create an account. Without that tick we do not keep the number
• Comply with legal obligations
• Analyze usage to improve the product (aggregated, anonymized)
• Measure our ads on Facebook and Instagram, on our website only and only if you choose "Accept all" (see Section 10)

We send no other promotional messages. We never use your plan, health information, documents or vault contents for advertising; the optional ad measurement in Section 10 is the only advertising use.

5. Legal Basis

Under DPDP we process your personal data on the basis of your consent. Where DPDP allows processing without consent (the "legitimate uses" in section 7 of the Act, for example to comply with a law or a court order), we rely on that instead. You can withdraw consent at any time; see Section 8.

How you give consent, and what we record:

• Creating an account.On our website you tick "I agree to the Terms of Service and the Privacy Policy" before any account is created, whichever way you sign up (email, Google, Apple or phone). The box starts unticked. If you sign in with Google, Apple or a phone number that has no account yet, we ask you to tick it before the account is made. Our iPhone and Android apps show the same box (accounts created in the apps before 9 October 2026 agreed by reading the notice on the sign-up screen and continuing). We keep a record of your consent: the date and time, the version of this policy (its "Last updated" date) and how you gave it. People who already had an account are not asked again.
• Product news and offers. This covers the one message about paid plans described in Section 4. It is on for accounts created with the consent above, and you can turn it off at any time in Settings → Notifications or with the one-click unsubscribe link in the email. Accounts created before 2 October 2026 agreed to the sign-up notice and this policy, so it is on for them too, and they can turn it off the same way.
• WhatsApp reminder after the quiz. Only if you tick the WhatsApp box next to the phone field. It starts unticked.
• Analytics and ad-measurement cookies.Only if you choose "Accept all" (see Section 10).

6. Data Sharing

We may share data with:

• Service providers: Google/Firebase (sign-in by email, phone OTP, Google, and Apple on iPhone), Supabase (database and file storage), Vercel (website hosting, plus cookie-free page statistics through Vercel Web Analytics and Speed Insights), Razorpay (web payments), Google Play and Apple App Store (in-app purchases), Apple and Google push services (app and browser notifications you turn on), Zoho ZeptoMail and Resend (transactional email), Zoho Mail (our support inbox, hello@sortmylegacy.com), Meta (WhatsApp Business Cloud API) for reminders and alerts, Sentry (error reports, set up not to send personal details), Google Analytics (only if you choose "Accept all"), and Meta Platforms (the Meta pixel and Conversions API, on our website only and only if you choose "Accept all"; see Section 10)
• Legal authorities: When required by law or to protect rights and safety
• Family/executors: Only as you configure (e.g., post-death access upon verification)

We do not sell your personal data. We never share your health information, documents or password-vault contents with any third party for advertising, and we never sell them.

7. Data Storage and Retention

Your data is hosted on secure cloud infrastructure operated by our service providers, located outside India (primarily in Singapore). Some providers (for example authentication and transactional email) may process data in other regions; where data is processed across borders we rely on contractual and technical safeguards consistent with applicable law. We retain your data for as long as your account is active and as needed to provide the Service. When you delete your account in Settings, your account data and uploaded files are deleted straight away. For deletion requests made by email, and for residual copies, we delete or anonymize data within our retention schedule (typically 30 to 90 days, except where law requires longer, such as tax records).

8. Your Rights

Under DPDP and our practices, you have the right to:

• Access: Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with. You can also download a full copy at any time in Settings ("Download my data")
• Correction: Have inaccurate or incomplete data corrected, completed, or updated. Most of it you can edit yourself in the Service
• Erasure: Have your data deleted (subject to legal retention), see our Account & Data Deletion page
• Nominate: Name a person who can use these rights for you if you die or become unable to. Email the Grievance Officer with that person's name and contact details
• Grievance redressal: Complain to our Grievance Officer. We acknowledge within 48 hours and resolve within one month, as required by law
• Complain to the Data Protection Board of India: If you are not satisfied with our answer to your grievance, you can complain to the Board
• Portability: Download your data in a portable (JSON) format in Settings

How to withdraw consent. Withdrawing is as easy as giving consent:

• Analytics cookies: use the "Turn off analytics" button in Section 10 below
• Ad measurement (Meta): use the "Turn off ad measurement" button in Section 10 below
• WhatsApp messages about your account: in Settings → Notifications, choose "Email"
• Product news and offers: turn off "Product news and offers" in Settings → Notifications, or use the one-click unsubscribe link at the bottom of the email. Messages about your account, payments, security and your family are not affected
• Promotional WhatsApp messages (including the quiz reminder): reply STOP to the message. Reply START if you change your mind
• Everything: delete your account in Settings, or email the Grievance Officer

Withdrawing consent does not affect processing that happened before you withdrew it. After you withdraw it, the features that depend on it stop working for you.

To exercise these rights, email the Grievance Officer at the address in Who we are, customer care and grievances below, or use our contact form. We may ask you to confirm the request comes from your registered email address. We apply the rights above to every user, wherever you live, we do not operate a weaker standard outside India.

If you live outside India, Section 14 explains the extra rights and information the privacy laws of the EU, UK, Switzerland, the United States, Brazil and other countries give you.

9. Security

We implement technical and organizational measures including encryption (in transit and at rest), access controls, and secure authentication. The password vault uses client-side encryption; we cannot access your stored passwords. You are responsible for safeguarding your account credentials and master password.

If a personal data breach affects you, we will tell you and report it to the Data Protection Board of India, as DPDP requires.

10. Cookies and Tracking

We use essential cookies for sign-in, your session, and your language choice. Everything else is optional and stays off until you choose "Accept all" in the cookie banner; if you choose "Essential only", none of it loads. With "Accept all": Google Analytics (anonymised, with its advertising features switched off) shows us which features people use; and, on our website only, Meta's pixel and Conversions API tell Meta when someone who saw our ads on Facebook or Instagram visits a page, finishes the quiz, signs up, starts a checkout or pays, so we can measure and improve those ads. For this Meta receives your browser identifiers, IP address and the page, and for those steps, if you are signed in, your email address as a one-way hash. It never receives your plan, health information, documents or vault. Meta uses this under its own terms and may use it to show you ads. Our iPhone and Android apps never load the Meta pixel, and if your browser sends Global Privacy Control we never load it either. Vercel Web Analytics and Speed Insights count page visits and page speed without cookies. You can change each choice here at any time:

11. Children

The Service is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has given us data, contact us and we will delete it.

12. Changes

We may update this Privacy Policy. We will notify you of material changes via email or a notice on the Site. Continued use after changes constitutes acceptance.

13. Contact

For privacy questions, to exercise your rights, or to make a complaint, contact the Grievance Officer using the details in Who we are, customer care and grievances below, or our contact form.

14. If you live outside India

Sort My Legacy is run from India by Nexivara and can be used worldwide. The rights in Section 8 apply to every user, wherever you live. This section adds what the main privacy laws outside India require us to tell you.

Where your data goes

Your account data, uploaded files and our website servers are in Singapore, and we run the Service from India. Some of the service providers in Section 6 process data in other countries, including the United States. If you use the Service from outside India, your data is therefore transferred to India, Singapore and those countries. We protect it with encryption in transit and at rest, access controls, and contracts that require our providers to protect it (including standard contractual clauses where a provider offers them).

European Union, EEA, United Kingdom and Switzerland (GDPR, UK GDPR, Swiss FADP)

• Controller: Nexivara, a sole proprietorship of Karan Bindal, at the address in Who we are below. Contact: hello@sortmylegacy.com.
• Representative: we are established only in India and have not appointed a representative in the EU, the UK or Switzerland. Please contact us directly at hello@sortmylegacy.com. Supervisory authorities can use the same address. We answer requests from people in these regions within one month.
• Legal bases: contract, to provide the Service you signed up for, including payments and messages about your account; legal obligation, for tax and accounting records and lawful requests; legitimate interests, to keep the Service secure, prevent fraud and false death reports, and fix errors (you can object to this); and consent, for analytics and ad-measurement cookies, WhatsApp messages, product news and the quiz reminder (you can withdraw it at any time).
• Health information: the medical directives and emergency card are optional. We process this special-category data only with your explicit consent, which you give by entering it. You can withdraw it by deleting those entries or your account.
• Transfers:India, Singapore and the United States do not all have an adequacy decision for your region. Where a provider's contract includes standard contractual clauses we rely on them; otherwise the transfer takes place because it is necessary to provide the Service you asked for (GDPR Article 49(1)(b) and its UK and Swiss equivalents).
• Your rights: access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. We make no decisions about you based solely on automated processing. Use Section 8 to make a request.
• Complaints:you can complain to the data protection authority where you live or work (in the UK, the Information Commissioner's Office; in Switzerland, the FDPIC).
• What you must give us: an email address or phone number to create an account. Everything else is optional; without it the related feature does not work.

United States (California and other states with privacy laws)

In the last 12 months we collected these categories of personal information: identifiers (name, email, phone number, IP address); financial information you choose to record; health information you choose to record (optional); commercial information (your plan and payments); internet activity (log data); and the content you upload. We collect it from you, and from family members who add you to their plan. We use it for the purposes in Section 4, disclose it for business purposes only to the service providers in Section 6, and keep it as described in Section 7.

You have the right to know what we collect and why, to access, correct and delete it, and not to be discriminated against for using these rights. You can use an authorised agent; we will verify the request with you. We do not sell your personal information.If you choose "Accept all" on our website, we share the limited data described in Section 10 with Meta to measure our ads, which California law may treat as "sharing" for cross-context behavioural advertising. You can opt out at any time with the "Turn off ad measurement" button in Section 10, and we treat a Global Privacy Control signal from your browser as an opt-out. We use sensitive personal information only to provide the Service you asked for. We do not disclose personal information to third parties for their own direct marketing.

Brazil (LGPD)

We rely on the same legal bases as above. You can ask us to confirm that we process your data, give you access, correct it, anonymise, block or delete unnecessary data, port it, tell you who we share it with, and withdraw consent. You can also complain to the ANPD.

Canada, Australia, Singapore and other countries

You have the rights your local law gives you, and we apply the rights in Section 8 to everyone. Your data may be disclosed to recipients in India, Singapore and the United States, as described above. You can complain to your local regulator, for example the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner or Singapore's Personal Data Protection Commission.